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REMARKS 

This application contains claims l-s, ia, n, 13-^15, 
20, 33, 35 and 46-69. Claim 13 has been amended. No new 
matter- has been introduced. Reconsideration is 

respectfully requested. 

Claim 13 has been amended to correct an informality. 
As this amendment will put the claim in better condition 
for allowance or appeal without changing the substance of 
the claim, Applicant requests that the Examiner enter the 
amendment notwithstanding the present final rejection. 

Claims 1-8, 10, 11, 13-16, 20, 33, 35 and 46-54 and 
56-69 were rejected under 35 U,S,C. 103(a) over Jungcfc 
{U.S. Patent 6,829,65*4) in view of Davies (U.S. Patent 
6,901,053). Applicant respectfully traverses this 

rejection. 

Jungck describes apparatus and methods for enhancing 
network infrastructure using edge servers and edge 
caches. The edge servers may also be used to detect 
malicious or otherwise unauthorized data transmissions 
(abstract) . The edge server includes a request 

interceptor, a request filter and a request transmitter 
(col. 1, line 62 - col. 2, line 9). The edge server can 
also monitor data transmission generated by clients for 
malicious program code (col. 28, lines 51-57) and can 
identify the originating client in a DDOS attack (col. 
29, lines 3-7) . 

Davies describes a priority routing service using an 
^express route" between network elements. Elements at 
each end of the express route divert packets transmitted 
between a certain user and a customer along the express 
route in order to avoid network bottlenecks (abstract) . 
The express route comprises reserved or dedicated 
bandwidths on specific paths or connections (col. 3, 
lines 46-47) . To determine the express routes, carrier 
nodes or elements where customer traffic is concentrated 
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are identified by analyzing typical traffic levels on 
various links within the network. The network elements 
at either end of the selected express route are modified 
to provide the desired traffic routing (col. 5, lines 43- 
56, cited by the Examiner) . This express route technique 
allows a carrier to offer an enhanced service to 
particular customers for receiving and/or transmitting 
data traffic to or from any source or destination (col. 
4, lines 62-65) . 

Claim 1 recites a method of responding to an 
overload condition, in which diversion of traffic by a 
first set of network elements is initiated in response to 
an indication of an anomalous traffic condition . The 
network elements in the first set divert traffic destined 
for a victim to a second set of network elements, which 
filter the diverted traffic and selectively pass a 
portion of the traffic to the victim, 

in rejecting claim 1, the Examiner acknowledged that 
tfungck does not teach initiating diversion of traffic due 
to an indication of an anomalous traffic condition, but 
maintained that this teaching is supplied by Davies. 
Davies, however, teaches the diametric opposite of claim 
1. * Anomalous " is used in claim 1, as well as in the 
specification of the present patent application, in 
accordance with its common, dictionary meaning: abnormal , 
or irregular (Webster's Third New International 
Dictionary) . Davies, on the other hand, determines links 
for his express routes based explicitly on " typical 
traffic levels" {col, 5, lines 46-51), meaning the 
regular (Webster's Third New International Dictionary) or 
normal (Webeter's New World Dictionary) traffic levels. 
Davies neither teaches nor suggests any use whatsoever 
for indications of anomalous traffic levels, let alone 
initiating diversion in response to such an indication. 
On the contrary, were Davies to base his express routes 



12 



PAGE 13/17 * RCVDAT 10/3/2006 2:21:50 PM [Eastern Daylight Time] * SVR:USPTO-EFXRF-5/10 * DNIS:2738300 * CSID:01116173109000 * DURATION (mm-$s):0248 



OCT . 3 . 2006 2 : 23PM NUTTERMCCLENNENF I SH NO. 088" — *P . 14 — 

48048A3 

on anomalous, rather than typical, traffic levels, the 
express routes would work poorly at beet. 

Thus, neither Jungck nor Davies can be taken to 
teach or suggest the step of initiating diversion of 
traffic reeponsively to an indication of an anomalous 
traffic condition, as recited in claim 1. Therefore, 
claim 1 is patentable over the cited art. In view of the 
patentability of claim 1, claims 2-8, 10, 11, 13-16, 20, 
33, 35 and 53-55, which depend from claim 1, are also 
believed to be patentable. 

Independent claim 46 recites a network element for 
use in protecting against an overload condition. The 
network element comprises an input, a filter for blocking 
traffic originating from a suspect source, a statistics 
module, and an output. The statistics module performs a 
statistical analysis of diverted traffic so as to detect 
an anomalous pattern of a flow associated with at least 
one source address. The filter blocks at least a portion 
of the data packets having such a source address. 

In rejecting this claim, the Examiner acknowledged 
that Jungck does not teach a statistics module that 
detects an anomalous flow pattern, but again maintained 
that Davies supplies the missing teaching. As pointed 
out above in reference to claim 1, however, Davies is 
concerned solely with determining typical (i.e., normal, 
regular) traffic levels or distribution. He neither 
teaches nor suggests detecting anomalous (abnormal, 
irregular) flow patterns, as required by claim 46, 
Therefore, claim 46 is patentable over the cited art, as 
are claims 47 and 48, which depend from claim 46. 

Independent claim 4d recites a system for use in 
protecting against an overload condition on a network. 
The system comprises one or more "guards," which comprise 
an input, a filter for selectively blocking traffic 
originating from a suspect source, a statistics module, 
and an output. One or more Miverters" selectively 
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initiate diversion to the guards of traffic otherwise 
destined for a victim responsive ly to detection of an 
anomalous traffic condition . 

In rejecting this claim, the Examiner acknowledged 
that JUngck does not teach diversion of traffic due to an 
indication of an anomalous traffic condition, but again 
maintained that the missing teaching is supplied by 
Davies. As explained above in reference to claim 1, 
however, Davies diverts traffic based solely on typical 
traffic levels or distributions. He neither teaches nor 
suggests that diversion might be initiated in response to 
detection of an anomalous traffic condition, as required 
by claim 49. Therefore, claim 49 is patentable over the 
cited art, as are claims 50-52, which depend from claim 
49. 

Independent claim 56 recites a method of responding 
to an overload condition, which operates on similar 
principles to the network element reaited in claim 46 s A 
statistical analysis of diverted traffic is performed so 
as to detect an anomalous flow pattern associated with a 
source address, and at least a portion of the data 
packets having the source address is then prevented from 
reaching the victim. As explained above in reference to 
claim 46, neither tfungck nor Davies teaches or suggests 
this sort of statistical analysis. Therefore, claim 56 
is patentable for the reasons explained above, as are 
claims S7-64, which depend from claim 56. 

Independent claim €6 recites a method of responding 
to an overload condition at a victim network element. 
The victim is coupled to receive traffic from a network 
via a first port of a network switch. The network switch 
is actuated to divert the traffic destined for the victim 
to a second port, to which a guard machine is coupled. 
The guard machine filters the diverted traffic and 
selectively passes at least a portion of the filtered 
traffic to the victim. 
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The Examiner gave no reason for the rejection of 
claim 66, other than the blanket statement that this 
claim "contain [a] the aame language of the claims already 
discussed above" and is "therefore-, rejected under the 
same rationale" (page 9, fourth paragraph, in the 
Official Action) . In fact, none of the claims discussed 
previously by the Examiner makes any reference at all to 
a network switch, let alone to the use of such a switch 
to divert traffic to a guard machine in the manner 
recited in claim 66. Neither Jtmgck nor Davies teaches 
or suggests using a network switch in this manner. 

There is one other claim that recices the use of a 
network switch to route traffic destined for a victim to 
a second port for processing by another network element-, 
dependent claim SS, which the Examiner found, to recite 
allowable subject matter. 

Thus, claim 66 is patentable over the cited art, as 
are claims 67-69, which depend from claim 66. 

Dependent claim 55 was objected to for depending 
from a rejected base claim, but was deemed to recite 
allowable subject matter. Claim 55 depends from claim 2, 
which in turn depends from claim 1. In view of the 
patentability of claim l, as explained above, Applicant 
believes that the objection to claim 55 should be 
withdrawn . 

Notwithstanding the patentability of the independent 
claims, the remaining dependent claims in this 
application are also believed to recite independently- 
patentable subject matter. For the sake of brevity, 
however. Applicant win refrain from arguing the 
independent patentability of che dependent claims at 
present . 

Applicant believes the amendments and remarks 
presented above to be fully responsive to all of the 
objections and grounds of rejection raised by the 
Examiner. m view of these amendments and remarks, all 
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the claims i n the present patent application are believed 
to be in condition for allowance . Prompt notice to this 
effect is requested, 



Respectfully submitted, 




David j, Powener 
Registration No, 31,868 
NUTTER MCCliENtfEN & FISH LLP 
World Trade Center West 
155 Seaport Boulevard 
Boston, Massachusetts 02210-2604 
(617) 439-2717 
(617) 310-9717 
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